CVE-2026-57192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57192", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.800Z", "datePublished": "2026-10-27T21:25:40.363Z", "dateUpdated": "2026-11-03T12:15:09.199Z"}, "containers": {"cna": {"title": "Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-131", "lang": "en", "description": "CWE-131: Incorrect Calculation of Buffer Size", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx"}, {"name": "https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079"}, {"name": "https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56"}, {"name": "https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb"}, {"name": "https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398"}, {"name": "https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c"}, {"name": "https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d"}, {"name": "https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"version": "< 20.7-cert11", "status": "affected"}, {"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:25:40.363Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "source": {"advisory": "GHSA-qf8j-jp7h-c5hx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T12:14:54.638010Z", "id": "CVE-2026-57192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T12:15:09.199Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T12:14:54.638010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T12:15:05.102Z"}}], "cna": {"title": "Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch", "source": {"advisory": "GHSA-qf8j-jp7h-c5hx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "references": [{"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx", "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079", "name": "https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56", "name": "https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb", "name": "https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398", "name": "https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c", "name": "https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d", "name": "https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006", "name": "https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131: Incorrect Calculation of Buffer Size"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:25:40.363Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57192", "state": "PUBLISHED", "dateUpdated": "2026-11-03T12:15:09.199Z", "dateReserved": "2026-06-24T02:00:46.800Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T21:25:40.363Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"product": "certified-asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "id": "CVE-2026-57192", "lastModified": "2026-11-03T13:17:22.567", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T12:14:54.638010Z", "version": "2.0.3"}}]}, "published": "2026-10-27T22:17:27.567", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asterisk: asterisk: Denial of Service via heap buffer overflow in Codec 2 decoder", "id": "2562440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562440"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.", "A flaw was found in Asterisk. An authenticated remote attacker can cause a Denial of Service (DoS) via a heap-based buffer overflow in the Codec 2 audio decoder. Due to a sample-count calculation mismatch, an attacker can establish a call and transmit specially crafted audio packets to corrupt memory and crash the service."], "name": "CVE-2026-57192", "public_date": "2026-10-27T21:25:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57192\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57192\nhttps://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079\nhttps://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56\nhttps://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb\nhttps://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398\nhttps://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c\nhttps://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d\nhttps://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006\nhttps://github.com/asterisk/asterisk/releases/tag/20.20.1\nhttps://github.com/asterisk/asterisk/releases/tag/21.12.3\nhttps://github.com/asterisk/asterisk/releases/tag/22.10.1\nhttps://github.com/asterisk/asterisk/releases/tag/23.4.1\nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nhttps://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx\nhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1"], "statement": "This vulnerability is rated Moderate because successful exploitation requires prior SIP authentication or trusted source IP verification, and the blast radius is primarily limited to service termination. In typical deployments, the Codec 2 translation module is not loaded by default and requires explicit configuration on the target endpoint. Consequently, telephony environments that do not negotiate Codec 2 or restrict authenticated endpoint access to trusted callers face minimal exposure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.20.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-pre1,21.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-pre1,22.10.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-pre1,23.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "asterisk", "source": "cna", "vendor": "asterisk"}, "product": "asterisk", "vendor": "asterisk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20.7-cert11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[22.8-cert1-pre1,22.8-cert3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "certified-asterisk", "source": "cna", "vendor": "asterisk"}, "product": "certified_asterisk", "vendor": "asterisk"}], "created": "2026-10-27T22:45:09.471652+00:00", "updated": "2026-10-27T23:00:16.784574+00:00", "vendors": ["asterisk", "asterisk$PRODUCT$asterisk", "asterisk$PRODUCT$certified_asterisk"]}